pjfanning opened a new pull request, #250: URL: https://github.com/apache/openserverless/pull/250
## What Adds the third-party Kubernetes manifests and configuration files that the source release physically ships to the top-level `LICENSE`, and propagates the `NOTICE` attribution for the two ASF upstreams among them. Found while verifying the 0.9.0-incubating RC5 source tarball. None of these were mentioned in the top-level `LICENSE`, whose "Bundled components" section only listed OpenWhisk, Spray and the Gradle wrapper. The `oplugins-op/LICENSE` only says the manifests *reference* third-party images; it does not say the manifest text itself is copied from upstream. ## Files covered Every upstream was verified by diffing the shipped file (ASF header removed) against the upstream artefact at the tag stated. All are **Apache License 2.0**. | Upstream | Version | Shipped copies | Match | |---|---|---|---| | cert-manager | v1.10.1, v1.11.0 | 5 × `cert-manager.yaml` | byte-identical to the GitHub release asset | | ingress-nginx | v1.5.1 / 1.7.0 / 1.7.1 / 1.8.1 | 7 manifests | upstream `deploy/static/provider/*` with 0–58 lines of local edits | | Kubegres | v1.18 | 3 × `kubegres-crd.yaml` | 2 copies identical to v1.18; the `testing/` copy is an older build | | Milvus Operator | v1.1.3 | 1 CRD bundle | rendered chart CRDs, 18 lines of Helm templating differ | | Milvus / milvus-helm | chart 4.2.32, config trimmed | 4 config maps + 2 rendered manifests | retains `Copyright (C) 2019-2021 Zilliz` | | MongoDB Community Operator | v0.7.3 | 1 CRD | byte-identical | | Prometheus community chart | (server config) | 1 ConfigMap | rendered | | Apache Kvrocks | 2.8.0 | 1 ConfigMap | `kvrocks.conf` with 16 lines of local edits | ## Non-Apache licences: none found, two things worth knowing - **MinIO chart 8.0.17** (rendered inside `milvus_manifest.yaml`): the chart templates are Apache-2.0. They were published by MinIO before its April 2021 switch to AGPL-3.0 and are redistributed by milvus-helm under that repo's Apache-2.0 licence. The MinIO **server image** is AGPL-3.0 but is only referenced, not shipped. - **MongoDB Community Operator**: the repo's `LICENSE.md` is Apache-2.0 for all source and content, with a separate proprietary licence for the MongoDB Agent **binary**. Only the CRD is shipped, so no proprietary content is included. The `LICENSE` text says so explicitly. ## Follow-ups outside this repo - `oplugins-op/deploy/cert-manager/cert-manager.yaml` (operator repo) had the upstream `# Copyright 2022 The cert-manager Authors.` header **removed** and replaced with the ASF header. The four copies in `oplugins` retained it. Apache-2.0 §4(c) requires keeping the notice, so that file needs a fix in `apache/openserverless-operator`. - `oplugins-op/LICENSE` should carry the same section, since the operator ships the same files on its own. - Every submodule `LICENSE`/`NOTICE` refers readers to a `WARN` file that `no-release.txt` strips from the source tarball. Not in scope here: the pre-built JS bundles under `oplugins/util` and `oplugins/admin/usage` embed MIT/ISC/BSD npm packages that are attributed only in `oplugins/NOTICE`, not the top-level `LICENSE`. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
